topic Re: HTTPS Inspection Not Working in Firewall and Security Management

HTTPS Inspection Not Working

DarrenR — Fri, 19 Jun 2020 22:22:12 GMT

Hello,

I recently stood up a standalone R80.40 gateway in a lab environment to perform some testing for policy changes to support Office 365. I'm working through a scenario with a customer who has HTTPS inspection enabled globally, but I'm unable to get inspection working on my lab gateway. I've enabled HTTPS Inspection on the Gateway, have verified the HTTPS Inspection Policy is what I want, and have adjusted the Topology so respective interfaces are configured appropriately.

There's not much to configure here, so I'm beating my head against a wall trying to figure out why this appliance isn't inspecting outbound HTTPS traffic. Any help would be appreciated!

Re: HTTPS Inspection Not Working

PhoneBoy — Fri, 19 Jun 2020 23:39:16 GMT

Screenshots of exactly what you've configured, what logs are getting generated with the relevant traffic would help.
Feel free to redact sensitive details.

Re: HTTPS Inspection Not Working

DarrenR — Sat, 20 Jun 2020 00:44:03 GMT

Here are a few screenshots of the configuration and I've followed the guide here when putting this in place.

Re: HTTPS Inspection Not Working

PhoneBoy — Sat, 20 Jun 2020 16:58:47 GMT

Your HTTPS Inspect rulebase should be more specific.
Specifically, the source should be the specific subnets from which you have traffic HTTPS inspected, not something general like any.
The destination of this rule can be any, not sure it works with the "All_Internet" object.
Second, for performance reasons, your last rule should always be any any bypass.

Re: HTTPS Inspection Not Working

HeikoAnkenbrand — Sun, 21 Jun 2020 08:37:07 GMT

Hi @DarrenR

A few more tips:
1) Did you import the outbound certificate correctly in the browser?
2) Are there log entries for https inspection? If so, please take a picture.
3) Is the https interception enabled in the protocol tab?

4) Set "Internet" instead of "all internet" in the destination:

Re: HTTPS Inspection Not Working

DarrenR — Sun, 21 Jun 2020 19:48:42 GMT

Boom! I missed the enabling the protocol signature. Thanks!

Re: HTTPS Inspection Not Working

Cmc — Tue, 08 Dec 2020 03:37:16 GMT

Can you tell me where the config is in your step 3 ? Because i couldn't find it. Thank you.

Re: HTTPS Inspection Not Working

archie — Fri, 15 Jan 2021 13:56:40 GMT

Can somebody tell me, where can I find the protocol tab and setup the protocol signature feature? Is this a must config to work with HTTPS Inspection?

So without this feature the inspection not working? Thanks!

Re: HTTPS Inspection Not Working

iko — Sat, 07 Aug 2021 13:37:22 GMT

can't find it either. does it still exist in R81?

Re: HTTPS Inspection Not Working

Tomer_Noy — Mon, 09 Aug 2021 09:08:31 GMT

Are you referring to the protocol setting in the Threat Prevention Profile editor?
Trying to extrapolate from the small screenshot, it looks like the setting that exists for the various Threat Prevention engines.

Indeed, it's possible to specify which protocols will be included in the scanning, but the default value for these profiles is to be "On" for HTTP/HTTPS. Most customers should not encounter this issue or have to touch this setting for HTTPS inspection to work.

Did you deactivate this in the past for your environment?
I'd like to better understand this case to make sure more customers don't encounter it.

Thanks!

Re: HTTPS Inspection Not Working

chethan_m — Wed, 13 Dec 2023 16:31:56 GMT

Where do you find that "Protocol" option with the checkbox for "Web (HTTP/HTTPS)"?

Re: HTTPS Inspection Not Working

the_rock — Wed, 13 Dec 2023 17:37:29 GMT

Re: HTTPS Inspection Not Working

chethan_m — Thu, 14 Dec 2023 16:15:06 GMT

Thank you. This I knew for Threat Prevention. I was wondering if there was another similar configuration available under HTTPS shared policies > inspection settings.

Re: HTTPS Inspection Not Working

the_rock — Thu, 14 Dec 2023 16:18:18 GMT

Only one I know is this

Andy